P introduced setSSID, UIDs and unwanted capabilities. None of these exhibit commutative behavior through combineCapabilities because their semantics don't allow it. Therefore NetworkRequest.setCapabilities() is badly broken around any of these. Look at the comments in the new tests to realize the extent of the damage. Bug: 79748782 Test: new tests written, old tests pass Change-Id: Ie46581bdaf9ecc2f14aab44788bbdb27a3fec8c1